Banking and Finance Law Daily Wrap Up, BANK SECRECY ACT—Treasury identifies Huione group as money laundering concern, (May 2, 2025)

By Shashi Kant, BALLB, LLM

Huione Group faces FinCEN action after $4 billion in illicit flows, including DPRK-linked heists and investment scams.

The U.S. Department of the Treasury’s Financial Crimes Enforcement Network (FinCEN) has issued a notice of proposed rulemaking (NPRM) designating Cambodia-based Huione Group as a foreign financial institution of “primary money laundering concern” under Section 311 of the USA PATRIOT Act. The designation cites the group’s alleged role in laundering proceeds from cyber-enabled crimes, including cryptocurrency theft and online scams. Comments on the proposal are due by June 4, 2025.

The proposed rule would prohibit U.S. financial institutions from opening or maintaining correspondent or payable-through accounts for or on behalf of the Huione Group. It would also require enhanced due diligence to prevent indirect exposure through foreign correspondent accounts.

FinCEN’s designation. FinCEN describes the Huione Group as a network of affiliated entities operating primarily from Cambodia. These entities include Huione Pay PLC, Huione Crypto, and Haowang Guarantee. Together, they provide services related to money transmission, virtual asset trading, and marketplace transactions. While the group is registered in multiple jurisdictions, including Cambodia and Poland, its primary operations are reportedly based in Phnom Penh. According to FinCEN’s investigation, Huione Group processed approximately $4 billion in transactions associated with cybercrime between August 2021 and January 2025. This includes at least $37 million linked to cyber heists attributed to North Korean-affiliated entities, $36 million from convertible virtual currency (CVC) investment scams, commonly referred to as “pig butchering,” and approximately $300 million from other cyber-related fraud and scam activity.

Structure of Huione. FinCEN states that the Huione Group provides a range of financial services through its three principal components. Huione Pay PLC is described as a registered payment service institution operating in Cambodia, facilitating fiat-to-crypto conversions and acting as a payment intermediary for both domestic and cross-border transactions. Huione Crypto offers crypto asset exchange services and has introduced a stablecoin known as USDH. According to FinCEN, this stablecoin is marketed as being pegged to the U.S. dollar and advertised as “non-freezable.” The third entity, Haowang Guarantee, operates an online marketplace that has allegedly been used to facilitate the sale of goods and services associated with cyber scams and other illicit activity. FinCEN reports that these entities share infrastructure, branding, and customer service mechanisms, and characterizes them as functioning collectively rather than independently.

Linkages to North Korean cyber operations. The NPRM outlines alleged ties between Huione Group and cyber operations associated with North Korea. According to FinCEN, the group received cryptocurrency traced to blockchain addresses linked to the Lazarus Group, a North Korean cyber unit previously designated by the U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC).

The document references cyberattacks on platforms such as Atomic Wallet, Coinspaid, and Alphapo in 2023, with stolen funds later transferred to wallets associated with Huione platforms. FinCEN further notes that approximately $35 million in cryptocurrency was transferred to the group following a May 2024 heist involving a Japanese virtual asset service provider. The U.S. authorities have attributed the theft to North Korean-affiliated actors. FinCEN’s findings also include reports of communication between Huione Pay PLC officials and a North Korean national allegedly affiliated with the Reconnaissance General Bureau (RGB), North Korea’s primary foreign intelligence agency.

Role in transnational CVC investment scams. Huione Group is also identified as a financial conduit for fraudulent investment schemes originating in Southeast Asia. These schemes, often referred to as “pig butchering,” involve long-term social engineering efforts to lure victims, typically through romantic or business pretexts, into transferring funds through CVC platforms.

The NPRM cites third-party analyses indicating Huione’s involvement in facilitating proceeds from such scams. Victims have reportedly been directed to send funds using Huione-affiliated platforms. Additionally, Haowang Guarantee has been linked to listings for equipment labeled as “detention tools,” including stun guns and shackles. FinCEN notes that such equipment may be associated with human trafficking operations connected to scam compounds in the region.

Compliance gaps. FinCEN’s investigation addresses concerns regarding Huione Group’s compliance practices. None of the group’s principal entities is reported to maintain publicly available anti-money laundering (AML) or know-your-customer (KYC) policies. FinCEN describes the group’s customer due diligence processes as either insufficient or entirely absent.

In one instance, Huione acknowledged that its KYC mechanisms were inadequate after failing to detect that funds linked to a North Korea-related cyber heist had passed through its systems. The group reportedly stated that its “KYC capabilities are now seriously insufficient,” citing the anonymity features of digital currencies as a limiting factor. Despite public reports of abuse, FinCEN found that Huione continued to process transactions linked to sanctioned actors and criminal networks.

Special measure under section 311. Section 311 of the USA PATRIOT Act authorizes the Secretary of the Treasury, delegated to FinCEN, to designate foreign financial institutions as being of “primary money laundering concern” and impose special measures to protect the U.S. financial system. In this case, FinCEN proposes invoking the fifth and most stringent measure: prohibiting U.S. financial institutions from maintaining correspondent or payable-through accounts on behalf of Huione Group.

The proposed rule also requires U.S. institutions to conduct due diligence to ensure that their foreign correspondent accounts are not being used indirectly to facilitate transactions involving the group. FinCEN has opened a 30-day public comment period following publication of the NPRM in the Federal Register, which is scheduled for May 5. The comment period will close on June 4, 2025. Comments may be submitted electronically via www.regulations.gov, referencing Docket Number FINCEN–2025–0004.

In the statement issued with the proposed rule, Secretary of the Treasury Scott Bessent said, “Today’s proposed action will sever Huione Group’s access to correspondent banking, degrading these groups’ ability to launder their ill-gotten gains.”

RegulatoryActivity: BankSecrecyAct CrimesOffenses IdentityTheft FinTech Privacy